Repository navigation
fix(deps): upgrade Next.js to 16.4.3 for three security advisories - #870
Merged
Merged
Conversation
Next.js 16.0.0-16.4.0 is affected by: - GHSA-2464-fhr4-w9xw (critical): unauthenticated RCE in the Image Optimization API when SVG files are used - GHSA-673q-mjm6-r5xr (critical): unauthenticated RCE in `use cache` functions returning typed arrays - GHSA-p3m5-59mp-jv5r (high): denial of service in the App Router through Server Actions `next build` now refuses to build an affected version, which blocked every production build and deploy. next and eslint-config-next move to 16.4.3 (patched from 16.4.1). The biometrics manifest pins pnpm-lock.yaml, so its dependency hash and the demo worker build hash are refreshed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@jasonlarue is attempting to deploy a commit to the therealng's projects Team on Vercel. A member of the Team first needs to authorize it. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update dependency ranges and recorded hashes package.json, modules/common/biometrics/manifest.v1.json, src/demo/biometrics/worker-build.json |
The next and eslint-config-next version ranges changed from ^16.1.6 to ^16.4.3. The recorded pnpm-lock.yaml hash and worker build hash changed. |
Sleep-stage window tests
| Layer / File(s) | Summary |
|---|---|
Test the rolling reference window src/mcp/tests/server.test.ts |
The sleep-stage test setup freezes the date and restores real timers after each test. A new test checks the reference-stage query window from October 12 to October 26, 2026, and expects 36 coverage epochs when one of two fixture segments is expired. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Other
Suggested reviewers: ng
Merge Risk: 
dfc56
-
No actionable current-head issue is established by the reviewed dependency and test changes.
Pre-merge checks: 
-
Check name Status Explanation Resolution Docstring Coverage Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. Write docstrings for the functions missing them to satisfy the coverage threshold. -
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title names the main change: upgrading Next.js to 16.4.3 to address three security advisories. The changeset matches this. The package.json bumps next and eslint-config-next from ^16.1.6 to ^16.4.… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title names the main change: upgrading Next.js to 16.4.3 to address three security advisories. The changeset matches this. The package.json bumps next and eslint-config-next from ^16.1.6 to ^16.4.3, and the manifest hash and worker build change follow from the lockfile update. The test file change (clock freeze for sleep-stage fixtures) is a secondary change that the title does not mention, which is acceptable because the title need not cover every detail. The title is 66 characters and uses the conventional commit prefix, so it is concise and specific.
-
-
Finishing Touches: 💡 1
-
🛠️ Fix failing CI checks: 💡
-
- Commit to this branch
- Create a new PR
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
ng
enabled auto-merge
October 25, 2026 18:08
1 of 3 tasks
ng
added a commit
that referenced
this pull request
Oct 30, 2026
…RV and breathing references, and schedule library (#878) Promotes `dev` to `main` with personal sleep-stage models, a heart-rate estimator that stops guessing on weak signal, beat-to-beat heartbeat detection, Watch HRV and breathing references, a schedule library, and the Next.js 16.4.3 security upgrade. ## Changes - Personal sleep-stage models: train off the pod from the phone's feature contracts, run them on the pod, keep several per side, upload a `candidate.json` from Settings, and stage a side's nights with its model when switched on. Includes MCP tools (#855, #857–#860, #864, #866). - Biometrics calibration on one page, with frozen dataset export and profile fitting on a laptop (#836, #837, #841). - Heart rate: windows scoring below `heart_rate.minimumPeakScore` (default 0.4) now report no heart rate instead of a guess. In local replay this cut Watch HR error from 5.2 to 1.75 bpm on tuning nights and from 4.3 to 3.1 bpm on held-back nights, at about 75% coverage (#840). - Beat-to-beat heartbeat detection in the piezo-processor, stored per minute in a new `heartbeats` table. Vitals are unchanged. Heartbeat retries now use bounded, ordered backoff (#848, #865). - Apple Watch references: import breathing rate and HRV (SDNN), add a pod-vs-Watch deviation report with night-by-night charts on the calibration page, render Watch-only nights, and archive pod biometrics off the pod for long-term comparison (#842, #844, #845, #847, #867). - Read-only analysis snapshot export (DB backup + RAW window) and MCP tool. Health export uploads are no longer truncated at 10 MB (#843, #839). - Schedule library with switchable curves, alarm snooze length with Snooze taper, and independent tap actions for normal and while-ringing (#835, #861, #849). - Storage: eMMC endurance card, RAM-only journal, and flash write insights with recording controls (#838, #854). - Surface the frzWater tank level and sensHealth cover disconnects, and register `sensHealth`, `frzWater` and `lps` as known record types (#872, #877). - Fix the internet access toggle after a reboot and the false "firewall rules missing" notice. Also fix false high TEC and slow fan warnings on an idle pod, and grant the service user journal read access (#856, #809, #801). - Security: upgrade Next.js to 16.4.3 for three advisories and require patched Node.js in development and pod installs (#870, #868). - Add the Europe/Bucharest timezone, update dependencies, fix the Renovate config, and kill surviving mutants (#874, #851, #853, #875, #852). ## Migrations - Configuration DB: schedule library, stale gesture alarm field cleanup, side stage models and the active model, and alarm snooze (0028–0034). - Biometrics DB: reference samples, heartbeats, and 0031 (0031–0033). ## Deploy note #840 bumps the biometrics manifest to 1.1.0. Profile revisions pinned to the old manifest will report `PROFILE_INCOMPATIBLE` and must be re-proposed against the new one. ## Test plan - [x] GitHub checks on the `dev` head (`1fbb953f`): CI, Build & Package, Dev Release, Publish OpenAPI Spec, Ref Collision Check. - [ ] After merge, wait for "Analyze & Release" on the `main` merge commit, then `sudo sp-update main` once on a pod and confirm the service starts and migrations apply. - [ ] Re-propose any active biometric profile against manifest 1.1.0 and confirm it applies. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrades Next.js to 16.4.3. The installed 16.4.0 is affected by three advisories, and
next buildnow refuses to build it, so every production build and deploy ofdevfails withSecurityFatalError: Your version of Next.js is affected by a known security vulnerability.use cachefunctions returning typed arraysAll three affect
>=16.0.0 <=16.4.0and are fixed from 16.4.1. The pod's API is unauthenticated on the LAN, so the RCE paths are worth closing regardless of the build gate.Changes
nextandeslint-config-next:^16.1.6(locked at 16.4.0) →^16.4.3, so@next/env,@next/swc-*and@next/eslint-plugin-nextmove with them.@babel/parser/types,browserslist,caniuse-lite,baseline-browser-mapping).pnpm-lock.yaml(dependencyHashes), so that hash is refreshed and the demo worker was rebuilt (worker-build.json).Checks
pnpm buildcompletes with no security stop; 44/44 static pages generated.tsc --noEmitandeslint . --max-warnings=0are clean.common(424 passed). The only failures:waveform-publication,runtime-integration,worker-child);src/mcp/tests/server.test.ts > get_sleep_stage_rules counts an in-bed night…(epochs72 vs 144). This fails ondevwithout this change too, so it's unrelated and probably date-dependent.🤖 Generated with Claude Code
Summary by CodeRabbit